CVE-2017-8386

Опубликовано: 01 июн. 2017

Источник: nvd

CVSS3: 8.8

CVSS2: 6.5

EPSS Высокий

Описание

git-shell in git before 2.4.12, 2.5.x before 2.5.6, 2.6.x before 2.6.7, 2.7.x before 2.7.5, 2.8.x before 2.8.5, 2.9.x before 2.9.4, 2.10.x before 2.10.3, 2.11.x before 2.11.2, and 2.12.x before 2.12.3 might allow remote authenticated users to gain privileges via a repository name that starts with a - (dash) character.

Ссылки

http://lists.opensuse.org/opensuse-updates/2017-05/msg00090.html
Mailing List
Third Party Advisory
http://public-inbox.org/git/xmqq8tm5ziat.fsf%40gitster.mtv.corp.google.com/
http://www.debian.org/security/2017/dsa-3848
Third Party Advisory
VDB Entry
http://www.securityfocus.com/bid/98409
Third Party Advisory
VDB Entry
http://www.securitytracker.com/id/1038479
Third Party Advisory
http://www.ubuntu.com/usn/USN-3287-1
Exploit
Third Party Advisory
https://access.redhat.com/errata/RHSA-2017:2004
https://access.redhat.com/errata/RHSA-2017:2491
https://insinuator.net/2017/05/git-shell-bypass-by-abusing-less-cve-2017-8386/
Mitigation
Third Party Advisory
https://kernel.googlesource.com/pub/scm/git/git/+/3ec804490a265f4c418a321428c12f3f18b7eff5
Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3ISHYFLM2ACYHHY3JHCLF75X7UF4ZMDM/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DPYRN7APMHY4ZFDPAKD22J5R4QJFY2JP/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FDS3LSJJ3YGGQYIVPKQDVOCXWDSF6JGF/
https://security.gentoo.org/glsa/201706-04
http://lists.opensuse.org/opensuse-updates/2017-05/msg00090.html
Mailing List
Third Party Advisory
http://public-inbox.org/git/xmqq8tm5ziat.fsf%40gitster.mtv.corp.google.com/
http://www.debian.org/security/2017/dsa-3848
Third Party Advisory
VDB Entry
http://www.securityfocus.com/bid/98409
Third Party Advisory
VDB Entry
http://www.securitytracker.com/id/1038479
Third Party Advisory
http://www.ubuntu.com/usn/USN-3287-1
Exploit
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:git:git-shell:-:*:*:*:*:*:*:*

Конфигурация 2

cpe:2.3:o:opensuse:leap:42.1:*:*:*:*:*:*:*

Конфигурация 3

cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*

Конфигурация 4

Одно из

cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:lts:*:*:*

cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:*

cpe:2.3:o:canonical:ubuntu_linux:16.10:*:*:*:*:*:*:*

cpe:2.3:o:canonical:ubuntu_linux:17.04:*:*:*:*:*:*:*

Конфигурация 5

Одно из

cpe:2.3:o:fedoraproject:fedora:24:*:*:*:*:*:*:*

cpe:2.3:o:fedoraproject:fedora:25:*:*:*:*:*:*:*

cpe:2.3:o:fedoraproject:fedora:26:*:*:*:*:*:*:*

EPSS

Процентиль: 99%

0.75646

Высокий

8.8 High

CVSS3

6.5 Medium

CVSS2

Дефекты

NVD-CWE-noinfo

Связанные уязвимости

CVE-2017-8386

CVSS3: 8.8

ubuntu

больше 8 лет назад

CVE-2017-8386

CVSS3: 5

redhat

больше 8 лет назад

CVE-2017-8386

CVSS3: 8.8

debian

больше 8 лет назад

git-shell in git before 2.4.12, 2.5.x before 2.5.6, 2.6.x before 2.6.7 ...

openSUSE-SU-2017:1422-1

suse-cvrf

больше 8 лет назад

Security update for git

SUSE-SU-2017:1432-1

suse-cvrf

больше 8 лет назад

Security update for git

EPSS

Процентиль: 99%

0.75646

Высокий

8.8 High

CVSS3

6.5 Medium

CVSS2

Дефекты

NVD-CWE-noinfo